Overview

overview

7

Static

static

3

2938752004...46.dll

windows10-2004-x64

7

2938752004...46.dll

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    128s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    25/09/2026, 12:34

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    293875200436f6637e7f4df4ec9b89e2ae7e8210f8b53293af8896eda8981446.dll
  • Size 7.9MB
  • Sample260925-prswaastf1
  • SHA256 293875200436f6637e7f4df4ec9b89e2ae7e8210f8b53293af8896eda8981446
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 37 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 63 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 55 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\293875200436f6637e7f4df4ec9b89e2ae7e8210f8b53293af8896eda8981446.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4908
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\293875200436f6637e7f4df4ec9b89e2ae7e8210f8b53293af8896eda8981446.dll,#1
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1884
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2524
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4484
          • C:\ProgramData\eDcvRtXGpUTSZbeEXpTkaLxUZxmtUyZN.jZJ\JZalkeFewGQFJaZghWiZAZriNjERoRpX.Vgq.exe
            "JZalkeFewGQFJaZghWiZAZriNjERoRpX.Vgq.exe"
            5⤵
            • Executes dropped EXE
            PID:120
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4808
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5464
          • C:\ProgramData\izvTLqHLXmCGlWHirUZhIZLzuQwStiCc.aPg\CtLVptKnutkPDXRJIAMCjhKollIHoOfw.ieF.exe
            "CtLVptKnutkPDXRJIAMCjhKollIHoOfw.ieF.exe"
            5⤵
            • Executes dropped EXE
            PID:5004
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2068
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3032
          • C:\ProgramData\vrSdOZYpMAOYRMZWUUFnAWGItrIhDxOx.xdE\WtCMRqmHVdkrQYWxzJdyzdDNHyqGcSlx.kcQ.exe
            "WtCMRqmHVdkrQYWxzJdyzdDNHyqGcSlx.kcQ.exe"
            5⤵
            • Executes dropped EXE
            PID:4176
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2092
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:768
          • C:\ProgramData\mXgslpvIxMWRHWwKYkfapJgVyPmhnxYI.lrL\roGKUENUFpqfoIwhORwQRzwvGKfGlOYb.MRG.exe
            "roGKUENUFpqfoIwhORwQRzwvGKfGlOYb.MRG.exe"
            5⤵
            • Executes dropped EXE
            PID:4620
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4196
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1192
          • C:\ProgramData\xWvTMTGVWJTiFPMeCoPrDNBAsBvQVIcF.uBq\xljadEkfhupOUQEXFrmJuSJUCunDNcUD.VKN.exe
            "xljadEkfhupOUQEXFrmJuSJUCunDNcUD.VKN.exe"
            5⤵
            • Executes dropped EXE
            PID:1652
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1392
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5556
          • C:\ProgramData\LmDcBtBpffBJjbUrUYoqaKPDowwFeRwx.zUD\CkkjcEbXwIbdmQdeQLwfbXwxUGdhWzXu.BJp.exe
            "CkkjcEbXwIbdmQdeQLwfbXwxUGdhWzXu.BJp.exe"
            5⤵
            • Executes dropped EXE
            PID:3484
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4528
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2916
          • C:\ProgramData\THjDRBgeBXpXobFXnMxEHXuAsvtcnomT.Yug\HiWeAXIGYJGDxcqNzftgvcxixZSQwycI.UYp.exe
            "HiWeAXIGYJGDxcqNzftgvcxixZSQwycI.UYp.exe"
            5⤵
            • Executes dropped EXE
            PID:4676
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1688
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3420
          • C:\ProgramData\JtMlBBdmWkYjHHRkRbkyaKfbMztsZvOf.djz\sqRyiHKIrByiLxhEkffqWQySDsbXwLZz.CWH.exe
            "sqRyiHKIrByiLxhEkffqWQySDsbXwLZz.CWH.exe"
            5⤵
            • Executes dropped EXE
            PID:4656
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1084
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5800
          • C:\ProgramData\dHoerDIYNZjiRRWVSTAVNEUwTKqSPjhG.Yey\myvNouFOjhfBvMeVkUxlhcqMtdupGAGm.KaF.exe
            "myvNouFOjhfBvMeVkUxlhcqMtdupGAGm.KaF.exe"
            5⤵
            • Executes dropped EXE
            PID:3120
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4512
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2132
          • C:\ProgramData\vLYafKeqsZvwuteLYKKaWUClfsLOkinq.Xni\dZDyqiAvUmWQYvHIJOrtlbmXmsorUXyG.adp.exe
            "dZDyqiAvUmWQYvHIJOrtlbmXmsorUXyG.adp.exe"
            5⤵
            • Executes dropped EXE
            PID:4560
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3044
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:824
          • C:\ProgramData\aZDHPsQihyRXIYXIOXZLQTKSATgSqQUD.nLM\ymxFIHWEmSChfyrwrbDfvyAiDWcjbajX.Sdl.exe
            "ymxFIHWEmSChfyrwrbDfvyAiDWcjbajX.Sdl.exe"
            5⤵
            • Executes dropped EXE
            PID:2076
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5988
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5212
          • C:\ProgramData\daysyhwgkebdRdqSSjolibCdsQmHbwZO.HjQ\IHSztvvPDCfkbwwltBiRNrbozYKbewkp.HDx.exe
            "IHSztvvPDCfkbwwltBiRNrbozYKbewkp.HDx.exe"
            5⤵
            • Executes dropped EXE
            PID:3376
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4236
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:52
          • C:\ProgramData\kpurAiZXRaCmSSuIjIfSRgUfGhWrLchC.sLt\TCZbIrfnhDUwrFZZXyvKtHxxIlTvdwka.XNE.exe
            "TCZbIrfnhDUwrFZZXyvKtHxxIlTvdwka.XNE.exe"
            5⤵
            • Executes dropped EXE
            PID:1040
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3668
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3456
          • C:\ProgramData\EAypdjauNPKMbifGfpPGtFkLuWBYgkMc.Fno\byUPCnKhbrmyDkkMXUlQbvCYkVeAYibi.gDG.exe
            "byUPCnKhbrmyDkkMXUlQbvCYkVeAYibi.gDG.exe"
            5⤵
            • Executes dropped EXE
            PID:200
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5004
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3696
          • C:\ProgramData\hsVmFClRwIpmfPsyKgwJVbXyJuUlBJAG.LdR\KPxIzFqJxOCYeyczSpLnsRYrfpwfXwVE.jKY.exe
            "KPxIzFqJxOCYeyczSpLnsRYrfpwfXwVE.jKY.exe"
            5⤵
            • Executes dropped EXE
            PID:4452
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2504
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4312
          • C:\ProgramData\AYBmhuccNOkpMQEgNkyyIdBrtxrcVPvQ.DrA\zqPiUJCaolFeKryjPHLVzgPDSUFKRxvS.Qpm.exe
            "zqPiUJCaolFeKryjPHLVzgPDSUFKRxvS.Qpm.exe"
            5⤵
            • Executes dropped EXE
            PID:2436
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:940
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2772
          • C:\ProgramData\NFPLVPjbbDUmCNqULQNicNiHQURCdzyq.ofV\aGXTnuONVMMIOucbLNcaRpgsHqTeAahx.BYw.exe
            "aGXTnuONVMMIOucbLNcaRpgsHqTeAahx.BYw.exe"
            5⤵
            • Executes dropped EXE
            PID:2868
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4132
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:632
          • C:\ProgramData\aKJHetCjFJpfZibogntmcdpcFbSuTGab.rtB\UoKicLaDkhbPqZPqPuJWbfBbRxZErcoe.zZA.exe
            "UoKicLaDkhbPqZPqPuJWbfBbRxZErcoe.zZA.exe"
            5⤵
            • Executes dropped EXE
            PID:1896
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2632
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1564
          • C:\ProgramData\JqPnPfeJqiEpeTbQgbeOwDzTyKnbTSBv.IQy\SZekBHaUKgwDjUZfhAHMdNmFCpSJfVkl.LGi.exe
            "SZekBHaUKgwDjUZfhAHMdNmFCpSJfVkl.LGi.exe"
            5⤵
            • Executes dropped EXE
            PID:2672
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1768
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3632
          • C:\ProgramData\IjiANzTiVBHiITvphlXjpsJVLunovhJc.Kja\JgaQvrLatdnYQMbOllWbFTHbxQrOnSHf.Blj.exe
            "JgaQvrLatdnYQMbOllWbFTHbxQrOnSHf.Blj.exe"
            5⤵
            • Executes dropped EXE
            PID:4904
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4920
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4212
          • C:\ProgramData\USEpEUTlvdkOBtCYXVlXcOGINCaeowbC.blY\SfhjsKoCJtLnlGWvEGsVohgGfaDLaYtE.JZd.exe
            "SfhjsKoCJtLnlGWvEGsVohgGfaDLaYtE.JZd.exe"
            5⤵
            • Executes dropped EXE
            PID:5096
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1628
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4692
          • C:\ProgramData\dMsQtbYQZZzojIDPTMIGvkVsSeifgFtt.HMC\oFxpOnSRXrETLvSHhyCqmrhmjJoxNBzQ.URO.exe
            "oFxpOnSRXrETLvSHhyCqmrhmjJoxNBzQ.URO.exe"
            5⤵
            • Executes dropped EXE
            PID:5868
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4816
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2460
          • C:\ProgramData\sWPltxoHEPHTbYmrNxRXkgPMxZUcdaiS.rPQ\xOnTBkcxUxRLaUmDnbfxDTPAeOLIvVvb.Rgg.exe
            "xOnTBkcxUxRLaUmDnbfxDTPAeOLIvVvb.Rgg.exe"
            5⤵
            • Executes dropped EXE
            PID:5664
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4760
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2060
          • C:\ProgramData\yISUMASQijxXznOfmMBAlIdWMFrxDkxs.Qdh\JuoVIlfqkEgeFBuxWaWBShUYMgFLnUZz.fsz.exe
            "JuoVIlfqkEgeFBuxWaWBShUYMgFLnUZz.fsz.exe"
            5⤵
            • Executes dropped EXE
            PID:5400
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2976
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
          • System Location Discovery: System Language Discovery
          PID:5116
          • C:\ProgramData\IiyECgwFnjUjxCPZDXoakZMsnqQovMtH.xcr\gJJAsCVhLjkxkRIFSItEMuFghThkXdGc.DWY.exe
            "gJJAsCVhLjkxkRIFSItEMuFghThkXdGc.DWY.exe"
            5⤵
            • Executes dropped EXE
            PID:732
      • C:\Windows\SysWOW64\cmd.exe
        /c "C:\Windows\System32\ComputerDefaults.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4144
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          C:\Windows\System32\ComputerDefaults.exe
          4⤵
            PID:3252
            • C:\ProgramData\BYYAwwUycpdbyTVuSMYMkCeTaqEksepR.Nvm\tNNPAejSEonUIcElNaaaQLexPUhePNfv.nGk.exe
              "tNNPAejSEonUIcElNaaaQLexPUhePNfv.nGk.exe"
              5⤵
              • Executes dropped EXE
              PID:3076
        • C:\Windows\SysWOW64\cmd.exe
          /c "C:\Windows\System32\ComputerDefaults.exe"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:3328
          • C:\Windows\SysWOW64\ComputerDefaults.exe
            C:\Windows\System32\ComputerDefaults.exe
            4⤵
            • System Location Discovery: System Language Discovery
            PID:4216
            • C:\ProgramData\OXChiesQDKCxgdfuUjaIJacNAovsHoJx.OZE\LGwznUIkFljGOfdHfsyplGHfAifcbUcH.TnS.exe
              "LGwznUIkFljGOfdHfsyplGHfAifcbUcH.TnS.exe"
              5⤵
              • Executes dropped EXE
              PID:3332
        • C:\Windows\SysWOW64\cmd.exe
          /c "C:\Windows\System32\ComputerDefaults.exe"
          3⤵
            PID:5056
            • C:\Windows\SysWOW64\ComputerDefaults.exe
              C:\Windows\System32\ComputerDefaults.exe
              4⤵
                PID:1040
                • C:\ProgramData\sVxmreMEtcKYEYyMfDGRPWVCshocaPYn.Plh\nioTDUcmuxvszRQFZqvwgriTpfmbCtAT.Zgo.exe
                  "nioTDUcmuxvszRQFZqvwgriTpfmbCtAT.Zgo.exe"
                  5⤵
                  • Executes dropped EXE
                  PID:4540
            • C:\Windows\SysWOW64\cmd.exe
              /c "C:\Windows\System32\ComputerDefaults.exe"
              3⤵
              • System Location Discovery: System Language Discovery
              PID:1464
              • C:\Windows\SysWOW64\ComputerDefaults.exe
                C:\Windows\System32\ComputerDefaults.exe
                4⤵
                • System Location Discovery: System Language Discovery
                PID:2528
                • C:\ProgramData\oYmrmMyRWUXHPcKHGZokYOPKWarnVFyz.ABI\YoaQuZItDszRZxTBhVZEqoJKvjiInUZB.WlA.exe
                  "YoaQuZItDszRZxTBhVZEqoJKvjiInUZB.WlA.exe"
                  5⤵
                  • Executes dropped EXE
                  PID:4104
            • C:\Windows\SysWOW64\cmd.exe
              /c "C:\Windows\System32\ComputerDefaults.exe"
              3⤵
              • System Location Discovery: System Language Discovery
              PID:2624
              • C:\Windows\SysWOW64\ComputerDefaults.exe
                C:\Windows\System32\ComputerDefaults.exe
                4⤵
                • System Location Discovery: System Language Discovery
                PID:2968
                • C:\ProgramData\gawckPmZuGozaTdISHjdxteJZahsboFe.EcX\QbGWoSQkLDvDhHLbpyURbnVviNFntXrh.lYz.exe
                  "QbGWoSQkLDvDhHLbpyURbnVviNFntXrh.lYz.exe"
                  5⤵
                  • Executes dropped EXE
                  PID:4952
            • C:\Windows\SysWOW64\cmd.exe
              /c "C:\Windows\System32\ComputerDefaults.exe"
              3⤵
              • System Location Discovery: System Language Discovery
              PID:4392
              • C:\Windows\SysWOW64\ComputerDefaults.exe
                C:\Windows\System32\ComputerDefaults.exe
                4⤵
                • System Location Discovery: System Language Discovery
                PID:2104
                • C:\ProgramData\RQDeCVFWYlXEBdcGxfNadZEzziVEbQiD.ECh\TzxDAwyVrrhuJpeZERzRmQYHvQIQXPnM.ZCx.exe
                  "TzxDAwyVrrhuJpeZERzRmQYHvQIQXPnM.ZCx.exe"
                  5⤵
                  • Executes dropped EXE
                  PID:6008
            • C:\Windows\SysWOW64\cmd.exe
              /c "C:\Windows\System32\ComputerDefaults.exe"
              3⤵
                PID:2648
                • C:\Windows\SysWOW64\ComputerDefaults.exe
                  C:\Windows\System32\ComputerDefaults.exe
                  4⤵
                  • System Location Discovery: System Language Discovery
                  PID:1348
                  • C:\ProgramData\geUTWMbKJCRSjYwvLdKhjmiraxcIjnqq.GzX\jCCYlAuuvgfbrASzvXzpAWXwBUnqKTbU.SEH.exe
                    "jCCYlAuuvgfbrASzvXzpAWXwBUnqKTbU.SEH.exe"
                    5⤵
                    • Executes dropped EXE
                    PID:2612
              • C:\Windows\SysWOW64\cmd.exe
                /c "C:\Windows\System32\ComputerDefaults.exe"
                3⤵
                • System Location Discovery: System Language Discovery
                PID:2856
                • C:\Windows\SysWOW64\ComputerDefaults.exe
                  C:\Windows\System32\ComputerDefaults.exe
                  4⤵
                  • System Location Discovery: System Language Discovery
                  PID:4736
                  • C:\ProgramData\JJEGccPeunugseTcoqTBmyqONUlNqIXx.DAM\ZWvdkOxWIhWxRxJjrVuCNLHWHHOrBWMt.cqn.exe
                    "ZWvdkOxWIhWxRxJjrVuCNLHWHHOrBWMt.cqn.exe"
                    5⤵
                    • Executes dropped EXE
                    PID:772
              • C:\Windows\SysWOW64\cmd.exe
                /c "C:\Windows\System32\ComputerDefaults.exe"
                3⤵
                • System Location Discovery: System Language Discovery
                PID:3484
                • C:\Windows\SysWOW64\ComputerDefaults.exe
                  C:\Windows\System32\ComputerDefaults.exe
                  4⤵
                  • System Location Discovery: System Language Discovery
                  PID:964
                  • C:\ProgramData\bJtybaYPucQbpoBKUyZtsrmArQAgPfhB.RhT\CMeAZFZjipvQyzJFMmFQOBmFKvFplhlX.Csd.exe
                    "CMeAZFZjipvQyzJFMmFQOBmFKvFplhlX.Csd.exe"
                    5⤵
                    • Executes dropped EXE
                    PID:3176
              • C:\Windows\SysWOW64\cmd.exe
                /c "C:\Windows\System32\ComputerDefaults.exe"
                3⤵
                • System Location Discovery: System Language Discovery
                PID:6112
                • C:\Windows\SysWOW64\ComputerDefaults.exe
                  C:\Windows\System32\ComputerDefaults.exe
                  4⤵
                  • System Location Discovery: System Language Discovery
                  PID:5172
                  • C:\ProgramData\HRFFpiEypTjmchdewrczTFyljmPIVGYL.Ccr\QzQJoAGFdNsCCHZyoaSBcJcPSINQrUMI.eND.exe
                    "QzQJoAGFdNsCCHZyoaSBcJcPSINQrUMI.eND.exe"
                    5⤵
                    • Executes dropped EXE
                    PID:4576
              • C:\Windows\SysWOW64\cmd.exe
                /c "C:\Windows\System32\ComputerDefaults.exe"
                3⤵
                • System Location Discovery: System Language Discovery
                PID:1076
                • C:\Windows\SysWOW64\ComputerDefaults.exe
                  C:\Windows\System32\ComputerDefaults.exe
                  4⤵
                    PID:5380
                    • C:\ProgramData\XbyCMIjpMwtJvYZIwyKSLASvCUDqGbYh.Tfs\ACqJVYdLiuvINQFFDxEZTdQsJbaNduOF.tPS.exe
                      "ACqJVYdLiuvINQFFDxEZTdQsJbaNduOF.tPS.exe"
                      5⤵
                      • Executes dropped EXE
                      PID:4828
                • C:\Windows\SysWOW64\cmd.exe
                  /c "C:\Windows\System32\ComputerDefaults.exe"
                  3⤵
                  • System Location Discovery: System Language Discovery
                  PID:3436
                  • C:\Windows\SysWOW64\ComputerDefaults.exe
                    C:\Windows\System32\ComputerDefaults.exe
                    4⤵
                    • System Location Discovery: System Language Discovery
                    PID:4600
                    • C:\ProgramData\ZxDXOEzjRMudDouFRegfqGCoOhRPjwRL.pbc\yNoMkgwFSpmjdNWRspJMZCTKOPbSqQsQ.lah.exe
                      "yNoMkgwFSpmjdNWRspJMZCTKOPbSqQsQ.lah.exe"
                      5⤵
                      • Executes dropped EXE
                      PID:4328

            Network

                  MITRE ATT&CK Enterprise v16

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  JZalkeFewGQFJaZghWiZAZriNjERoRpX.Vgq.exe
                  • Path C:\ProgramData\eDcvRtXGpUTSZbeEXpTkaLxUZxmtUyZN.jZJ\JZalkeFewGQFJaZghWiZAZriNjERoRpX.Vgq.exe
                  • Size 51KB
                  • SHA256 ce6bb7eddc83762c708d4a41709ae00371dbdc09b2a380f28fa60b1edf917473
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  PdFcoRE8.dLL
                  • Path C:\ProgramData\vrSdOZYpMAOYRMZWUUFnAWGItrIhDxOx.xdE\PdFcoRE8.dLL
                  • Size 2.7MB
                  • SHA256 b582ef710b7e37384e1979604342c3921af48f92c67d161d641811dac750372c
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  PdFcoRE8.dLL.rtf
                  • Path C:\ProgramData\vrSdOZYpMAOYRMZWUUFnAWGItrIhDxOx.xdE\PdFcoRE8.dLL.rtf
                  • Size 2.7MB
                  • SHA256 426d2619d8e32bcca4653ee6fe626495e90078b2e6ea827e829aa16a7c970553
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  3115.okm
                  • Path C:\Users\Public\WindowsApps\ndX&!}qPG\3115.okm
                  • Size 17KB
                  • SHA256 671e564fa73da5f33f6591d27eef6d3f02264c94f4cf85328bab1412a7fcb687
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  3115.okm.rtf
                  • Path C:\Users\Public\WindowsApps\ndX&!}qPG\3115.okm.rtf
                  • Size 17KB
                  • SHA256 df84fd6a0fd2735b117295de2f0564ef877a243706cc717eeb6fb906cad2d3fd
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  814.luD
                  • Path C:\Users\Public\WindowsApps\ndX&!}qPG\814.luD
                  • Size 32KB
                  • SHA256 fb1c10d2d9e89ae8263faaed9b211bd1585896fc8eb4bc21622942a8a22cee09
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  814.luD.rtf
                  • Path C:\Users\Public\WindowsApps\ndX&!}qPG\814.luD.rtf
                  • Size 32KB
                  • SHA256 20d34744171ed9e3ff682f62a655a0514ce73fcfaf7950ba63a8235f4a39bad8
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download